Updating database certificate in DBaaS

Create Secret containing DBaaS CA certificates. NetBackup version 10.4 stores db cert in db-cert configMap instead of KeyVault/SecretsManager secret. The db-cert configMap is created by trust manager.

Perform the following to create Secret containing DBaaS CA certificates:

AKS-specific:

TLS_FILE_NAME='/tmp/tls.crt'
 
rm -f ${TLS_FILE_NAME}
 
DB_CERT_URL="https://cacerts.digicert.com/DigiCertGlobalRootCA.crt.pem"
 
curl ${DB_CERT_URL} --output ${TLS_FILE_NAME}
 
kubectl -n netbackup create secret generic postgresql-netbackup-ca --save-config --dry-run=client --from-file ${TLS_FILE_NAME} -o yaml | kubectl apply -f -

EKS-specific:

TLS_FILE_NAME='/tmp/tls.crt'
PROXY_FILE_NAME='/tmp/proxy.pem'
  
rm -f ${TLS_FILE_NAME} ${PROXY_FILE_NAME}
  
DB_CERT_URL="https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem"
DB_PROXY_CERT_URL="https://www.amazontrust.com/repository/AmazonRootCA1.pem"
  
curl ${DB_CERT_URL} --output ${TLS_FILE_NAME}
curl ${DB_PROXY_CERT_URL} --output ${PROXY_FILE_NAME}
  
cat ${PROXY_FILE_NAME} >> ${TLS_FILE_NAME}
  
kubectl -n netbackup create secret generic postgresql-netbackup-ca --save-config --dry-run=client --from-file ${TLS_FILE_NAME} -o yaml | kubectl apply -f -

Restart the primary pod using the following command:
kubectl rollout restart "statefulset/${PRIMARY}" --namespace "${NAMESPACE}"

Updating database certificate in DBaaS

Feedback

Feedback